Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 09:12
Static task
static1
Behavioral task
behavioral1
Sample
bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe
Resource
win7-20240903-en
General
-
Target
bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe
-
Size
454KB
-
MD5
79179c0b8d6fd4fa975ff44d5267fab0
-
SHA1
a5f148c7d8423c017ae21250b938802bb1249916
-
SHA256
bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2c
-
SHA512
c04a5e7d63132e3718106b25d01313d882666fb4e7f4d0699bb840ab6680319485c973ab144b7a05911647aba26700686c5efef0d037ead2ee83a5ab66d93b11
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-313-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1524-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-517-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-516-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-571-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2908-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-699-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1120-786-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-876-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-932-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2320 5flfrfr.exe 2516 vdpdp.exe 848 1fflrfr.exe 2040 pjjdj.exe 2820 ffxfrfr.exe 2756 lxfxlxr.exe 2912 nbttnh.exe 2872 rfrxxrr.exe 2600 hnnhhh.exe 2768 fxxlxlx.exe 2648 pdppj.exe 1660 nnnbnb.exe 2948 ppvvj.exe 2864 bbbhnb.exe 1984 xrrllxx.exe 1488 7vvpd.exe 3052 xfflllx.exe 2952 vdppv.exe 348 jdppd.exe 2164 nhhntn.exe 2256 ddjvd.exe 2992 nhntbh.exe 2564 thbhbh.exe 1892 nhthnt.exe 1976 pdjdj.exe 920 tthhnt.exe 1832 rxrrfxl.exe 2380 bttthh.exe 1296 vvvjj.exe 1944 hhntnh.exe 2132 dvppv.exe 1628 ttthbn.exe 1524 dpjvd.exe 1640 rxfxxxl.exe 2496 bbhbth.exe 2260 5jvjj.exe 2040 rlfffrl.exe 2192 rfffrfx.exe 2612 bttnbn.exe 2792 ppdpp.exe 2968 rxrxllr.exe 2892 tbtbnb.exe 2908 vppjj.exe 2924 rrllrlx.exe 2600 llrfrlx.exe 628 hbhhbn.exe 2356 3ppvp.exe 1400 rflllxf.exe 2860 fxxxflx.exe 2796 1hbbht.exe 2948 3ddpv.exe 2864 flflflr.exe 1696 frxxlxx.exe 1744 hthbhb.exe 2172 vddpd.exe 1608 3jppv.exe 1616 ffxlxlf.exe 2208 tthtnh.exe 1656 nttbhh.exe 1180 pvdpp.exe 2256 llxlrxl.exe 2988 xrrlrfr.exe 1284 hhbthn.exe 1468 vvjvd.exe -
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-909-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-939-0x00000000003B0000-0x00000000003DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2320 2388 bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe 30 PID 2388 wrote to memory of 2320 2388 bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe 30 PID 2388 wrote to memory of 2320 2388 bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe 30 PID 2388 wrote to memory of 2320 2388 bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe 30 PID 2320 wrote to memory of 2516 2320 5flfrfr.exe 31 PID 2320 wrote to memory of 2516 2320 5flfrfr.exe 31 PID 2320 wrote to memory of 2516 2320 5flfrfr.exe 31 PID 2320 wrote to memory of 2516 2320 5flfrfr.exe 31 PID 2516 wrote to memory of 848 2516 vdpdp.exe 32 PID 2516 wrote to memory of 848 2516 vdpdp.exe 32 PID 2516 wrote to memory of 848 2516 vdpdp.exe 32 PID 2516 wrote to memory of 848 2516 vdpdp.exe 32 PID 848 wrote to memory of 2040 848 1fflrfr.exe 33 PID 848 wrote to memory of 2040 848 1fflrfr.exe 33 PID 848 wrote to memory of 2040 848 1fflrfr.exe 33 PID 848 wrote to memory of 2040 848 1fflrfr.exe 33 PID 2040 wrote to memory of 2820 2040 pjjdj.exe 34 PID 2040 wrote to memory of 2820 2040 pjjdj.exe 34 PID 2040 wrote to memory of 2820 2040 pjjdj.exe 34 PID 2040 wrote to memory of 2820 2040 pjjdj.exe 34 PID 2820 wrote to memory of 2756 2820 ffxfrfr.exe 35 PID 2820 wrote to memory of 2756 2820 ffxfrfr.exe 35 PID 2820 wrote to memory of 2756 2820 ffxfrfr.exe 35 PID 2820 wrote to memory of 2756 2820 ffxfrfr.exe 35 PID 2756 wrote to memory of 2912 2756 lxfxlxr.exe 36 PID 2756 wrote to memory of 2912 2756 lxfxlxr.exe 36 PID 2756 wrote to memory of 2912 2756 lxfxlxr.exe 36 PID 2756 wrote to memory of 2912 2756 lxfxlxr.exe 36 PID 2912 wrote to memory of 2872 2912 nbttnh.exe 37 PID 2912 wrote to memory of 2872 2912 nbttnh.exe 37 PID 2912 wrote to memory of 2872 2912 nbttnh.exe 37 PID 2912 wrote to memory of 2872 2912 nbttnh.exe 37 PID 2872 wrote to memory of 2600 2872 rfrxxrr.exe 38 PID 2872 wrote to memory of 2600 2872 rfrxxrr.exe 38 PID 2872 wrote to memory of 2600 2872 rfrxxrr.exe 38 PID 2872 wrote to memory of 2600 2872 rfrxxrr.exe 38 PID 2600 wrote to memory of 2768 2600 hnnhhh.exe 39 PID 2600 wrote to memory of 2768 2600 hnnhhh.exe 39 PID 2600 wrote to memory of 2768 2600 hnnhhh.exe 39 PID 2600 wrote to memory of 2768 2600 hnnhhh.exe 39 PID 2768 wrote to memory of 2648 2768 fxxlxlx.exe 40 PID 2768 wrote to memory of 2648 2768 fxxlxlx.exe 40 PID 2768 wrote to memory of 2648 2768 fxxlxlx.exe 40 PID 2768 wrote to memory of 2648 2768 fxxlxlx.exe 40 PID 2648 wrote to memory of 1660 2648 pdppj.exe 41 PID 2648 wrote to memory of 1660 2648 pdppj.exe 41 PID 2648 wrote to memory of 1660 2648 pdppj.exe 41 PID 2648 wrote to memory of 1660 2648 pdppj.exe 41 PID 1660 wrote to memory of 2948 1660 nnnbnb.exe 42 PID 1660 wrote to memory of 2948 1660 nnnbnb.exe 42 PID 1660 wrote to memory of 2948 1660 nnnbnb.exe 42 PID 1660 wrote to memory of 2948 1660 nnnbnb.exe 42 PID 2948 wrote to memory of 2864 2948 ppvvj.exe 43 PID 2948 wrote to memory of 2864 2948 ppvvj.exe 43 PID 2948 wrote to memory of 2864 2948 ppvvj.exe 43 PID 2948 wrote to memory of 2864 2948 ppvvj.exe 43 PID 2864 wrote to memory of 1984 2864 bbbhnb.exe 44 PID 2864 wrote to memory of 1984 2864 bbbhnb.exe 44 PID 2864 wrote to memory of 1984 2864 bbbhnb.exe 44 PID 2864 wrote to memory of 1984 2864 bbbhnb.exe 44 PID 1984 wrote to memory of 1488 1984 xrrllxx.exe 45 PID 1984 wrote to memory of 1488 1984 xrrllxx.exe 45 PID 1984 wrote to memory of 1488 1984 xrrllxx.exe 45 PID 1984 wrote to memory of 1488 1984 xrrllxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe"C:\Users\Admin\AppData\Local\Temp\bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\5flfrfr.exec:\5flfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\vdpdp.exec:\vdpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\1fflrfr.exec:\1fflrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\pjjdj.exec:\pjjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lxfxlxr.exec:\lxfxlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nbttnh.exec:\nbttnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rfrxxrr.exec:\rfrxxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hnnhhh.exec:\hnnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\fxxlxlx.exec:\fxxlxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\pdppj.exec:\pdppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\nnnbnb.exec:\nnnbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\ppvvj.exec:\ppvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bbbhnb.exec:\bbbhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xrrllxx.exec:\xrrllxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\7vvpd.exec:\7vvpd.exe17⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xfflllx.exec:\xfflllx.exe18⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vdppv.exec:\vdppv.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jdppd.exec:\jdppd.exe20⤵
- Executes dropped EXE
PID:348 -
\??\c:\nhhntn.exec:\nhhntn.exe21⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ddjvd.exec:\ddjvd.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhntbh.exec:\nhntbh.exe23⤵
- Executes dropped EXE
PID:2992 -
\??\c:\thbhbh.exec:\thbhbh.exe24⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nhthnt.exec:\nhthnt.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pdjdj.exec:\pdjdj.exe26⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tthhnt.exec:\tthhnt.exe27⤵
- Executes dropped EXE
PID:920 -
\??\c:\rxrrfxl.exec:\rxrrfxl.exe28⤵
- Executes dropped EXE
PID:1832 -
\??\c:\bttthh.exec:\bttthh.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380 -
\??\c:\vvvjj.exec:\vvvjj.exe30⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hhntnh.exec:\hhntnh.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dvppv.exec:\dvppv.exe32⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ttthbn.exec:\ttthbn.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dpjvd.exec:\dpjvd.exe34⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rxfxxxl.exec:\rxfxxxl.exe35⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bbhbth.exec:\bbhbth.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5jvjj.exec:\5jvjj.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rlfffrl.exec:\rlfffrl.exe38⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rfffrfx.exec:\rfffrfx.exe39⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bttnbn.exec:\bttnbn.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ppdpp.exec:\ppdpp.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rxrxllr.exec:\rxrxllr.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tbtbnb.exec:\tbtbnb.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vppjj.exec:\vppjj.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rrllrlx.exec:\rrllrlx.exe45⤵
- Executes dropped EXE
PID:2924 -
\??\c:\llrfrlx.exec:\llrfrlx.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbhhbn.exec:\hbhhbn.exe47⤵
- Executes dropped EXE
PID:628 -
\??\c:\3ppvp.exec:\3ppvp.exe48⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rflllxf.exec:\rflllxf.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fxxxflx.exec:\fxxxflx.exe50⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1hbbht.exec:\1hbbht.exe51⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3ddpv.exec:\3ddpv.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\flflflr.exec:\flflflr.exe53⤵
- Executes dropped EXE
PID:2864 -
\??\c:\frxxlxx.exec:\frxxlxx.exe54⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hthbhb.exec:\hthbhb.exe55⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vddpd.exec:\vddpd.exe56⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3jppv.exec:\3jppv.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ffxlxlf.exec:\ffxlxlf.exe58⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tthtnh.exec:\tthtnh.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nttbhh.exec:\nttbhh.exe60⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pvdpp.exec:\pvdpp.exe61⤵
- Executes dropped EXE
PID:1180 -
\??\c:\llxlrxl.exec:\llxlrxl.exe62⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xrrlrfr.exec:\xrrlrfr.exe63⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hhbthn.exec:\hhbthn.exe64⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vvjvd.exec:\vvjvd.exe65⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pppjd.exec:\pppjd.exe66⤵PID:1904
-
\??\c:\hbtbhn.exec:\hbtbhn.exe67⤵PID:940
-
\??\c:\bbbhth.exec:\bbbhth.exe68⤵PID:2144
-
\??\c:\ppppp.exec:\ppppp.exe69⤵PID:2976
-
\??\c:\ffxlxxl.exec:\ffxlxxl.exe70⤵PID:3004
-
\??\c:\7bbhnt.exec:\7bbhnt.exe71⤵PID:2012
-
\??\c:\9hntnt.exec:\9hntnt.exe72⤵PID:1296
-
\??\c:\ppdpv.exec:\ppdpv.exe73⤵PID:2056
-
\??\c:\7vpvj.exec:\7vpvj.exe74⤵PID:896
-
\??\c:\llflxrf.exec:\llflxrf.exe75⤵PID:1620
-
\??\c:\hhbnhh.exec:\hhbnhh.exe76⤵PID:1632
-
\??\c:\ppjdp.exec:\ppjdp.exe77⤵PID:1524
-
\??\c:\ddvdj.exec:\ddvdj.exe78⤵PID:2320
-
\??\c:\llfllfr.exec:\llfllfr.exe79⤵PID:1664
-
\??\c:\9hntbh.exec:\9hntbh.exe80⤵PID:2008
-
\??\c:\3tntbn.exec:\3tntbn.exe81⤵PID:2840
-
\??\c:\3dpvj.exec:\3dpvj.exe82⤵PID:2748
-
\??\c:\vjjvd.exec:\vjjvd.exe83⤵PID:2024
-
\??\c:\fffrlrf.exec:\fffrlrf.exe84⤵
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\9hhhbh.exec:\9hhhbh.exe85⤵PID:2916
-
\??\c:\vpdjj.exec:\vpdjj.exe86⤵PID:2712
-
\??\c:\9pjpp.exec:\9pjpp.exe87⤵PID:2624
-
\??\c:\1frlllx.exec:\1frlllx.exe88⤵PID:2908
-
\??\c:\1hntbn.exec:\1hntbn.exe89⤵PID:2720
-
\??\c:\pdjpv.exec:\pdjpv.exe90⤵PID:668
-
\??\c:\dvvdj.exec:\dvvdj.exe91⤵PID:820
-
\??\c:\7lxfflr.exec:\7lxfflr.exe92⤵PID:2000
-
\??\c:\btnthn.exec:\btnthn.exe93⤵PID:296
-
\??\c:\9thhht.exec:\9thhht.exe94⤵PID:2844
-
\??\c:\pvpjp.exec:\pvpjp.exe95⤵PID:2436
-
\??\c:\9flrxrr.exec:\9flrxrr.exe96⤵PID:1516
-
\??\c:\7tbttb.exec:\7tbttb.exe97⤵PID:1936
-
\??\c:\ttthhn.exec:\ttthhn.exe98⤵PID:2196
-
\??\c:\jppvj.exec:\jppvj.exe99⤵PID:2304
-
\??\c:\lxllxxl.exec:\lxllxxl.exe100⤵PID:1372
-
\??\c:\nhntnt.exec:\nhntnt.exe101⤵PID:1772
-
\??\c:\pdvdd.exec:\pdvdd.exe102⤵PID:348
-
\??\c:\pjjpv.exec:\pjjpv.exe103⤵
- System Location Discovery: System Language Discovery
PID:552 -
\??\c:\rrrfrfl.exec:\rrrfrfl.exe104⤵
- System Location Discovery: System Language Discovery
PID:1864 -
\??\c:\1nnbnt.exec:\1nnbnt.exe105⤵PID:696
-
\??\c:\ttnnhb.exec:\ttnnhb.exe106⤵PID:1968
-
\??\c:\pdvpd.exec:\pdvpd.exe107⤵PID:1120
-
\??\c:\xrfrfrx.exec:\xrfrfrx.exe108⤵PID:1284
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe109⤵PID:1916
-
\??\c:\vvddj.exec:\vvddj.exe110⤵PID:1904
-
\??\c:\xffrflx.exec:\xffrflx.exe111⤵PID:1268
-
\??\c:\btnnnb.exec:\btnnnb.exe112⤵PID:2144
-
\??\c:\nnhbbn.exec:\nnhbbn.exe113⤵PID:2976
-
\??\c:\vvvdv.exec:\vvvdv.exe114⤵PID:2308
-
\??\c:\fxffrxx.exec:\fxffrxx.exe115⤵PID:2964
-
\??\c:\hnbttb.exec:\hnbttb.exe116⤵PID:900
-
\??\c:\7tntbh.exec:\7tntbh.exe117⤵PID:1924
-
\??\c:\pvpvj.exec:\pvpvj.exe118⤵PID:1520
-
\??\c:\1lfrxlr.exec:\1lfrxlr.exe119⤵PID:2084
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe120⤵PID:2512
-
\??\c:\tbthnb.exec:\tbthnb.exe121⤵PID:352
-
\??\c:\jjvjd.exec:\jjvjd.exe122⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-